wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 10:47:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Changes following peer review, add defines to disable for any HW port

Browse Source
This commit is contained in:
kaleb-himes
2019-07-08 16:28:35 -06:00
parent 0b5ee1b633
commit b8c6bc0d7f
4 changed files with 36 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
src/internal.c
View File

@ -11571,9 +11571,10 @@ static int DoDtlsHandShakeMsg(WOLFSSL* ssl, byte* input, word32* inOutIdx,
#ifdef HAVE_AEAD #ifdef HAVE_AEAD
#if ((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \ #if !defined(NO_PUBLIC_GCM_SET_IV) && \
(((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) || \ (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) || \
(defined(HAVE_POLY1305) && defined(HAVE_CHACHA)) (defined(HAVE_POLY1305) && defined(HAVE_CHACHA)))
static WC_INLINE void AeadIncrementExpIV(WOLFSSL* ssl) static WC_INLINE void AeadIncrementExpIV(WOLFSSL* ssl)
{ {
int i; int i;
@ -11933,8 +11934,9 @@ static int ChachaAEADDecrypt(WOLFSSL* ssl, byte* plain, const byte* input,
#if defined(BUILD_AESGCM) || defined(HAVE_AESCCM) #if defined(BUILD_AESGCM) || defined(HAVE_AESCCM)
#if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \ #if !defined(NO_GCM_ENCRYPT_EXTRA) && \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)) ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
/* The following type is used to share code between AES-GCM and AES-CCM. */ /* The following type is used to share code between AES-GCM and AES-CCM. */
typedef int (*AesAuthEncryptFunc)(Aes* aes, byte* out, typedef int (*AesAuthEncryptFunc)(Aes* aes, byte* out,
const byte* in, word32 sz, const byte* in, word32 sz,
@ -12057,8 +12059,9 @@ static WC_INLINE int EncryptDo(WOLFSSL* ssl, byte* out, const byte* input,
* IV length minus the authentication tag size. */ * IV length minus the authentication tag size. */
c16toa(sz - AESGCM_EXP_IV_SZ - ssl->specs.aead_mac_size, c16toa(sz - AESGCM_EXP_IV_SZ - ssl->specs.aead_mac_size,
ssl->encrypt.additional + AEAD_LEN_OFFSET); ssl->encrypt.additional + AEAD_LEN_OFFSET);
#if (defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \ #if !defined(NO_PUBLIC_GCM_SET_IV) && \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)) ((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)))
XMEMCPY(ssl->encrypt.nonce, XMEMCPY(ssl->encrypt.nonce,
ssl->keys.aead_enc_imp_IV, AESGCM_IMP_IV_SZ); ssl->keys.aead_enc_imp_IV, AESGCM_IMP_IV_SZ);
XMEMCPY(ssl->encrypt.nonce + AESGCM_IMP_IV_SZ, XMEMCPY(ssl->encrypt.nonce + AESGCM_IMP_IV_SZ,
@ -12076,8 +12079,9 @@ static WC_INLINE int EncryptDo(WOLFSSL* ssl, byte* out, const byte* input,
ret = wolfSSL_AsyncPush(ssl, asyncDev); ret = wolfSSL_AsyncPush(ssl, asyncDev);
} }
#endif #endif
#if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \ #if !defined(NO_PUBLIC_GCM_SET_IV) && \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)) ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
XMEMCPY(out, XMEMCPY(out,
ssl->encrypt.nonce + AESGCM_IMP_IV_SZ, AESGCM_EXP_IV_SZ); ssl->encrypt.nonce + AESGCM_IMP_IV_SZ, AESGCM_EXP_IV_SZ);
#endif #endif
@ -12209,8 +12213,9 @@ static WC_INLINE int Encrypt(WOLFSSL* ssl, byte* out, const byte* input, word16
ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm) ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm)
{ {
/* finalize authentication cipher */ /* finalize authentication cipher */
#if (defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \ #if !defined(NO_PUBLIC_GCM_SET_IV) && \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)) ((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)))
AeadIncrementExpIV(ssl); AeadIncrementExpIV(ssl);
#endif #endif
if (ssl->encrypt.nonce) if (ssl->encrypt.nonce)
@ -14164,9 +14169,10 @@ int BuildMessage(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
goto exit_buildmsg; goto exit_buildmsg;
} }
#if (defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \ #if !defined(NO_PUBLIC_GCM_SET_IV) && \
((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)) && \ (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)) && \
defined(HAVE_AEAD) defined(HAVE_AEAD))
if (ssl->specs.cipher_type == aead) { if (ssl->specs.cipher_type == aead) {
if (ssl->specs.bulk_cipher_algorithm != wolfssl_chacha) if (ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
XMEMCPY(args->iv, ssl->keys.aead_exp_IV, AESGCM_EXP_IV_SZ); XMEMCPY(args->iv, ssl->keys.aead_exp_IV, AESGCM_EXP_IV_SZ);

20
src/keys.c
View File

@ -2611,8 +2611,9 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
if (gcmRet != 0) return gcmRet; if (gcmRet != 0) return gcmRet;
XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV, XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
AEAD_MAX_IMP_SZ); AEAD_MAX_IMP_SZ);
#if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \ #if !defined(NO_PUBLIC_GCM_SET_IV) && \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)) ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
if (!skipIv) { if (!skipIv) {
gcmRet = wc_AesGcmSetIV(enc->aes, AESGCM_NONCE_SZ, gcmRet = wc_AesGcmSetIV(enc->aes, AESGCM_NONCE_SZ,
keys->client_write_IV, AESGCM_IMP_IV_SZ, rng); keys->client_write_IV, AESGCM_IMP_IV_SZ, rng);
@ -2635,8 +2636,9 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
if (gcmRet != 0) return gcmRet; if (gcmRet != 0) return gcmRet;
XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV, XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
AEAD_MAX_IMP_SZ); AEAD_MAX_IMP_SZ);
#if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \ #if !defined(NO_PUBLIC_GCM_SET_IV) && \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)) ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
if (!skipIv) { if (!skipIv) {
gcmRet = wc_AesGcmSetIV(enc->aes, AESGCM_NONCE_SZ, gcmRet = wc_AesGcmSetIV(enc->aes, AESGCM_NONCE_SZ,
keys->server_write_IV, AESGCM_IMP_IV_SZ, rng); keys->server_write_IV, AESGCM_IMP_IV_SZ, rng);
@ -2711,8 +2713,9 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
} }
XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV, XMEMCPY(keys->aead_enc_imp_IV, keys->client_write_IV,
AEAD_MAX_IMP_SZ); AEAD_MAX_IMP_SZ);
#if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \ #if !defined(NO_PUBLIC_CCM_SET_NONCE) && \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)) ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
if (!skipIv) { if (!skipIv) {
CcmRet = wc_AesCcmSetNonce(enc->aes, keys->client_write_IV, CcmRet = wc_AesCcmSetNonce(enc->aes, keys->client_write_IV,
AEAD_MAX_IMP_SZ); AEAD_MAX_IMP_SZ);
@ -2739,8 +2742,9 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
} }
XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV, XMEMCPY(keys->aead_enc_imp_IV, keys->server_write_IV,
AEAD_MAX_IMP_SZ); AEAD_MAX_IMP_SZ);
#if (!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \ #if !defined(NO_PUBLIC_CCM_SET_NONCE) && \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)) ((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
if (!skipIv) { if (!skipIv) {
CcmRet = wc_AesCcmSetNonce(enc->aes, keys->server_write_IV, CcmRet = wc_AesCcmSetNonce(enc->aes, keys->server_write_IV,
AEAD_MAX_IMP_SZ); AEAD_MAX_IMP_SZ);

2
wolfcrypt/src/wc_encrypt.c
View File

@ -116,7 +116,7 @@ int wc_AesCbcEncryptWithKey(byte* out, const byte* in, word32 inSz,
#endif /* !NO_AES && HAVE_AES_CBC */ #endif /* !NO_AES && HAVE_AES_CBC */
#ifndef NO_DES3 #if !defined(NO_DES3) && !defined(WOLFSSL_TI_CRYPT)
int wc_Des_CbcEncryptWithKey(byte* out, const byte* in, word32 sz, int wc_Des_CbcEncryptWithKey(byte* out, const byte* in, word32 sz,
const byte* key, const byte* iv) const byte* key, const byte* iv)
{ {

5
wolfssl/wolfcrypt/settings.h
View File

@ -722,6 +722,11 @@ extern void uITRON4_free(void *p) ;
#define USE_WOLF_STRTOK /* use with HAVE_ALPN */ #define USE_WOLF_STRTOK /* use with HAVE_ALPN */
#define HAVE_TLS_EXTENSIONS #define HAVE_TLS_EXTENSIONS
#define HAVE_AESGCM #define HAVE_AESGCM
#ifdef WOLFSSL_TI_CRYPT
#define NO_GCM_ENCRYPT_EXTRA
#define NO_PUBLIC_GCM_SET_IV
#define NO_PUBLIC_CCM_SET_NONCE
#endif
#define HAVE_SUPPORTED_CURVES #define HAVE_SUPPORTED_CURVES
#define ALT_ECC_SIZE #define ALT_ECC_SIZE